Provenote MCP Outcome Workflows

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.1.1

Overview

The skill is coherent and not malicious, but it asks users to install and run mutable external code and exposes under-scoped mutation capabilities.

Install only if you trust the Provenote repository and are comfortable running its MCP server locally. Prefer pinning a reviewed commit or release, using locked dependency installation, running it in a restricted workspace or account, and requiring explicit confirmation before draft, research-thread, auditable-run, or settings mutations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/INSTALL.md:7

Finding

Unpinned Remote Source and Dependencies Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: references/INSTALL.md:7-24, references/OPENHANDS_MCP_CONFIG.json:4-8, and references/OPENCLAW_MCP_CONFIG.json:5-9
Vulnerability Type: Unpinned remote payload retrieval and software supply-chain exposure
Risk Level: Medium

Vulnerable Code

references/INSTALL.md:7-24:

markdown

- a local clone of `https://github.com/xiaojiou176-open/provenote`
- `uv`
- a workspace where the host can launch shell commands

## 1. Clone and install the repo

```bash
git clone https://github.com/xiaojiou176-open/provenote.git
cd provenote
uv sync

2. Make the MCP server launchable

Provenote exposes its MCP server through the repo-owned entrypoint:

bash

cd /absolute/path/to/provenote
uv run provenote-mcp

text

`references/OPENHANDS_MCP_CONFIG.json:4-8`:

```json
"command": "bash",
"args": [
  "-lc",
  "cd /absolute/path/to/provenote && uv run provenote-mcp"
]

references/OPENCLAW_MCP_CONFIG.json:5-9:

json

"command": "bash",
"args": [
  "-lc",
  "cd /absolute/path/to/provenote && uv run provenote-mcp"
]

Technical Analysis

The installation instructions clone the current default branch of an external GitHub repository without pinning a reviewed commit, immutable release, checksum, or cryptographic signature. They then run uv sync, which resolves and installs code and dependencies defined by that mutable remote repository.

The resulting MCP entry point is subsequently executed through bash -lc. Consequently, the code that runs is not fully represented by the audited Skill package and can change after this Skill has been reviewed. The package also does not include the fetched source or a dependency lockfile that would allow the effective runtime payload and transitive dependencies to be verified during this audit.

This is primarily a remote payload retrieval and execution risk, with an ...[truncated 1802 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Provenote source to a reviewed, immutable commit hash rather than cloning and executing the current default branch:

   bash

   git clone https://github.com/xiaojiou176-open/provenote.git
   cd provenote
   git checkout --detach <reviewed-commit-sha>
   

2. Prefer a signed release and verify its signature or published checksum before installation.

3. Commit and distribute a reviewed dependency lockfile, then require locked installation:

   bash

   uv sync --locked
   

   Configure the process to fail rather than silently re-resolve dependencies.

4. Document the exact Provenote release and commit corresponding to the declared canonical version instead of relying only on a mutable repository URL.

5. Review all transitive dependencies and restrict package indexes to intended, trusted sources. Where supported, verify hashes for downloaded artifacts.

6. Avoid invoking a general-purpose shell when it is unnecessary. Configure the MCP host to execute uv directly and use a fixed working-directory option supplied by the host:

   json

   {
     "command": "uv",
     "args": ["run", "--locked", "provenote-mcp"],
     "cwd": "/absolute/path/to/provenote"
   }
   

7. Run the MCP server under a dedicated, least-privileged account or sandbox. Restrict filesystem access, environment variables, credentials, and outbound network access to what the documented workflow requires.

8. Re-audit the pinned Provenote source and lockfile because they are outside the supplied Skill package and were not available in this audit.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger research thread is a generic phrase that could plausibly appear in ordinary user requests unrelated to this specific skill. The file does not provide constraints or negative examples to clarify when this trigger should invoke the skill versus when it should not.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents the workflow as 'read-first' but repeatedly recommends write-capable operations such as create, to_draft, auditable_run.create, and settings.mutate. This mismatch can mislead host agents or reviewers about the actual authority the skill expects, making unsafe write actions more likely to occur under the guise of a low-risk read-oriented workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The capabilities document broadens the skill surface beyond the advertised read-first workflow by explicitly including settings.mutate, which is a state-changing administrative capability. In an agent setting, documenting and normalizing mutation-oriented settings access can cause the agent to treat configuration changes as in-scope, increasing the chance of unintended host-side modifications or policy drift.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The demo explicitly instructs the agent to perform a state-changing action (research_thread.to_draft or draft.verify) after listing artifacts, which expands the skill from read-first inspection into mutation. In an agent setting, even a narrow write can modify repo-owned notes or workflow state unexpectedly, especially if the user expected a non-destructive demonstration aligned with the skill’s described read-first workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.